CVE-2026-12789

Name of the Vulnerable Software and Affected Versions ILIAS Learning Management System version 11.0

Description An issue exists in the Learning Progress Tracking component within the ilTrQuery::executeQueries() function of the components/ILIAS/Tracking/classes/class.ilTrQuery.php file. Remote manipulation of the troup table nav argument allows for SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.